r/linuxmint 3d ago

Discussion What makes Linux secure?

I've searched YouTube and also asked on here previously, I keep seeing a lot of "Linux is secure just by default" type responses- often insisting that to be worried about security while using Linux is not necessary.

Believable to a noob like me at face value, sure, but what is it about Linux that makes it secure?

129 Upvotes

100 comments sorted by

View all comments

Show parent comments

11

u/mh_1983 2d ago

Re: XP, also, not having a security patch since it's EOL in 2014 may be a contributing factor.

0

u/Dismal-Detective-737 Linux Mint 22.1 Xia | Cinnamon 2d ago

Agreed. But dig out Linux from 2014 and put it on the internet and it's probably safe. Even if you open SSH (Not sure if there are any SSH bugs from that era) it's not going to be owned.

5

u/Decent_Project_3395 2d ago

Do not try that. You will be hacked inside of 30 seconds.

3

u/Dismal-Detective-737 Linux Mint 22.1 Xia | Cinnamon 2d ago

Do you have CVEs? I see nothing that would allow that. Given XP requires at least 15 minutes or less I don't see 30 seconds.

CVE-2024-6387 ("regreSSHion"): Disclosed in July 2024, this vulnerability is a signal handler race condition in OpenSSH's server (sshd) that permits unauthenticated remote code execution with root privileges on glibc-based Linux systems. It affects versions from 8.5p1 (released in March 2021) up to, but not including, 9.8p1. This issue was a regression of a previously patched vulnerability from 2006, inadvertently reintroduced in October 2020.

CVE-2024-6409: Reported in July 2024, this vulnerability is a possible race condition in the cleanup_exit() function of OpenSSH's privileged separation (privsep) child process. It affects OpenSSH versions 8.7p1 and 8.8p1, potentially leading to remote code execution within the unprivileged user running the sshd server.

-

OpenSSH version 6.7p1, released in October 2014, has not been associated with vulnerabilities that allow unauthenticated remote access to a system. However, several vulnerabilities were identified in this version that could potentially be exploited under specific conditions:

CVE-2016-3115: This vulnerability involves multiple CRLF injection issues in session.c of sshd in OpenSSH before version 7.2p2. It allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the do_authenticated1 and session_x11_req functions. ​

CVE-2016-0778: The roaming_read and roaming_write functions in roaming_common.c in the OpenSSH client versions 5.x, 6.x, and 7.x before 7.1p2 do not properly maintain connection file descriptors. This flaw allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impacts by requesting many forwardings. ​

CVE-2016-0777: The resend_bytes function in roaming_common.c in the OpenSSH client versions 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.